An externally‑controlled format string exists in the PostgreSQL timeofday() function that can be triggered by crafted timezone values. When an attacker can influence the timezone parameter, the function may read portions of the server’s memory and expose them via the query result. The vulnerability is classified as CWE-134 and enables information disclosure, but it does not provide remote code execution or denial of service capabilities.

The flaw affects PostgreSQL installations running any version earlier than 18.4, 17.10, 16.14, 15.18, or 14.23. It is present in all releases below these thresholds and is mitigated in the subsequent patched versions.

The weighted score is CVSS 4.3, indicating moderate risk. No EPSS value is reported, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred from the description: an attacker must supply a malicious timezone string, which is possible over the network or via a client that can set the TZ parameter. No additional authentication or privilege requirements are explicitly mentioned, so the threat is potentially available to anyone who can send a query to the database.